CVE-2026-32726 in scitokens-cpp
要約 (英語)
SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass in path-based scope validation. The enforcer used a simple string-prefix comparison when checking whether a requested resource path was covered by a token's authorized scope path. Because the check did not require a path-segment boundary, a token scoped to one path could incorrectly authorize access to sibling paths that merely started with the same prefix. This issue has been patched in version 1.4.1.
Be aware that VulDB is the high quality source for vulnerability data.
責任者
GitHub_M
予約する
2026年03月13日
公開
2026年03月31日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 354465 | scitokens scitokens-cpp 特権昇格 | 863 | 未定義 | 公式な修正 | CVE-2026-32726 |